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AMENDMENTS TO THE CLAIMS 

1 . (Currently amended) A data processing method including receiving input data 
containing a plurality of instruction codes, and judging whether or not a process executed based 
on the instruction codes contained in the received data is a malicious process, said method being 
characterized by comprising: 

retrieving an instruction code related to a branch instruction from the data; 

storing a branch origin address associated with the retrieved instruction code and a 
branch destination address associated with a branch destination of the instruction code; 

judging whether or not an instruction code for calling an instruction code group for 
executing a predetermined process is associated with the branch destination address; 

storing a call destination address of the instruction code if the instruction code is 
associated with the branch destination address; and 

judging whether or not the stored call destination address is between the branch origin 
address and the branch destination address ; and 

concluding that the process executed based on the instruction codes contained in the data 
is a malicious process, when the instruction code for calling the instruction code group for 
executing the predetermined process is associated with the branch destination address and the 
call destination address of the instruction code is between the branch origin address and the 
branch destination address . 

2. (Currently amended) A data processor including means for receiving input data 

containing a plurality of instruction codes, forjudging whether or not a process executed based 
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on the instruction codes contained in the received data is a malicious process, said data processor 

means for retrieving an instruction code related to a branch instruction from the data; 

means for storing a branch origin address associated with the retrieved instruction code 
and a branch destination address associated with a branch destination of the instruction code; 

means forjudging whether or not an instruction code for calling an instruction code 
group for executing a predetermined process is associated with the branch destination address; 

means for storing a call destination address of the instruction code if the instruction code 
is associated with the branch destination address; and 

means forjudging whether or not the stored call destination address is between the 
branch origin address and the branch destination addres s; and means for outputting information 
indicating that the data is data for executing a malicious process if the call destination address is 
between the branch origin address and the branch destination address , wherein 

it is concluded that the process executed based on the instruction codes contained in the 
data is a malicious process, when the instruction code for calling the instruction code group for 
executing the predetermined process is associated with the branch destination address and the 
call destination address of the instruction code is between the branch origin address and the 
branch destination address . 

3. (Currently amended) The data processor as set forth in claim 2, characterized by 
further comprising means forjudging whether or not a predetermined character string is 
associated with a return address of the instruction code group, wherein if the character string is 

3 MKM/AE:cb 



Application No. 10/523,690 



Docket No.: 1560-0422PUS1 



Amendment dated August 19, 2008 
Reply to Office Action of May 27, 2008 

associated with the return address, the information indicating that the data is data for executing a 
malicious process is outputted. 

4. (Currently Amended) A data processor including means for receiving input data 
containing a plurality of instruction codes, forjudging whether or not a process executed based 
on the instruction codes contained in the data received by the means is a malicious process, said 



means for retrieving an instruction code for calling an instruction code group for 
executing a predetermined process from the data; and 

means forjudging whether or not a predetermined character string is associated with a 



the data is data for executing a malicious process if the character string is associated with the 
return address , wherein 

it is concluded that the process executed based on the instruction codes contained in the 
data is a malicious process, when the instruction code for calling the instruction code group for 
executing the predetermined process is in the data and the predetermined character string is 
associated with the return address of the instruction code group . 

5. (Currently Amended) A data processor including means for receiving input data 
containing a plurality of instruction codes, forjudging whether or not a process executed based 
on the instruction codes contained in the data received by the means is a malicious process, said 




return address of the instruction code group ; and 



for outputting information indicating that 
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means for retrieving an instruction code for calling an instruction code group for 
executing a predetermined process from the data; and 

means forjudging whether or not an instruction code for obtaining a return address of the 
instruction code group is contained in the instruction code group if the instruction code is 
retrieve d; and means for outputting information indicating that the data i s data for executing a 
malicious process if the instruction code is contained in the instruction code group , wherein 

it is concluded that the process executed based on the instruction codes contained in the 
data is a malicious process, when the instruction code for calling the instruction code group for 
executing the predetermined process is in the data and the instruction code for obtaining the 
return address of the instruction code group is contained in the instruction code group . 

6. (Canceled) 



7. (Currently Amended) A computer-readable memory product storing a computer 
program including a step of causing a computer to judge whether or not a process executed based 
on input data containing a plurality of instruction codes is a malicious process, characterized in 
that-the stored computer program comprisin g comprises : 

a step of causing the computer to retrieve an instruction code related to a branch 
instruction from the data; 

a step of causing the computer to store a branch origin address associated with the 
retrieved instruction code and a branch destination address associated with a branch destination 
of the instruction code; 
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a step of causing the computer to judge whether or not an instruction code for calling an 

instruction code group for executing a predetermined process is associated with the branch 

destination address; 

a step of causing the computer to store a call destination address of the instruction code if 
the instruction code is associated with the branch destination address; 

a step of causing the computer to judge whether or not the stored call destination address 
is between the branch origin address and the branch destination address ; and 

causing the computer to conclude that the process executed based on the instruction 
codes contained in the data is a malicious process, when the instruction code for calling the 
instruction code group for executing the predetermined process is associated with the branch 
destination address and the call destination address of the instruction code is between the branch 
origin address and the branch destination address . 

8. (New) A data processor comprising: 

an input unit for inputting data containing a plurality of instruction codes; 
a storing unit for storing the data input by the input unit; and 
a controller capable of performing operations of; 

retrieving an instruction code related to a branch instruction from the data stored 
in the storing unit; 

storing a branch origin address associated with the retrieved instruction code and 
a branch destination address associated with a branch destination of the instruction code in the 
storing unit; 
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judging whether or not an instruction code for calling an instruction code group 
for executing a predetermined process is associated with the branch destination address; 

storing a call destination address of the instruction code in the storing unit if the 
instruction code is associated with the branch destination address; 

judging whether or not the stored call destination address is between the branch 
origin address and the branch destination address; and 

concluding that the process executed based on the instruction codes contained in 
the data is a malicious process, when the instruction code for calling the instruction code group 
for executing the predetermined process is associated with the branch destination address and the 
call destination address of the instruction code is between the branch origin address and the 
branch destination address. 



9. (New) A data processor comprising: 

an input unit for inputting data containing a plurality of instruction codes; 
a storing unit for storing the data input by the input unit; and 
a controller capable of performing operations of; 

retrieving an instruction code for calling an instruction code group for executing a 
predetermined process from the data; 

judging whether or not a predetermined character string is associated with a return 
address of the instruction code group; and 

concluding that the process executed based on the instruction codes contained in 
the data is a malicious process, when the instruction code for calling the instruction code group 
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for executing the predetermined process is in the data and the predetermined character string is 
associated with the return address of the instruction code group. 



10. (New) A data processor: comprising: 

an input unit for inputting data containing a plurality of instruction codes; 
a storing unit for storing the data input by the input unit; and 
a controller capable of performing operations of; 

retrieving an instruction code for calling an instruction code group for executing a 
predetermined process from the data; 

judging whether or not an instruction code for obtaining a return address of the 
instruction code group is contained in the instruction code group if the instruction code is 
retrieved; and 

concluding that the process executed based on the instruction codes contained in 
the data is a malicious process, when the instruction code for calling the instruction code group 
for executing the predetermined process is in the data and the instruction code for obtaining the 
return address of the instruction code group is contained in the instruction code group. 
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